Security Box Score — July 29, 2026

274 CVEs published, led by Apache Software Foundation (41).

274 CVEs published July 29, 2026: 47 critical, 116 high, 103 medium, 8 low; 1 in the KEV catalog at press time; 5 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 249 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	8916	21319	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

920 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	834	2314	207	1231	637	1	11	2	0.1	7.8	.0016	+321 ▲
microsoft	664	1421	105	981	321	14	286	24	1.7	7.8	.0047	+444 ▲
google	121	1386	157	634	556	39	77	6	0.4	7.8	.0025	-587 ▼
red hat	133	355	16	140	175	24	2	0	0.0	6.5	.0030	+18 ▲
apple	167	271	57	78	133	3	88	7	2.6	6.5	.0027	+115 ▲
canonical	7	27	3	8	11	5	0	0	0.0	5.6	.0014	+1 ▲
suse	8	21	4	12	4	1	0	0	0.0	8.5	.0039	+2 ▲
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0016	-9 ▼

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	16	38	8	18	12	0	56	12	31.6	7.5	.0057	+6 ▲
ubiquiti	25	36	14	21	1	0	3	3	8.3	8.8	.0049	+17 ▲
palo alto networks	14	25	1	3	14	7	13	2	8.0	4.7	.0028	+5 ▲
fortinet	14	23	6	6	11	0	28	6	26.1	7.2	.0040	+12 ▲
netgear	6	23	0	0	22	1	0	0	0.0	4.6	.0024	-11 ▼
f5	8	16	5	8	3	0	4	1	6.3	8.6	.0057	+2 ▲
vmware	8	12	1	8	2	1	7	1	8.3	8.2	.0039	+5 ▲
checkpoint	3	12	3	6	3	0	3	2	16.7	7.7	.0455	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	165	320	63	139	106	11	33	1	0.3	7.5	.0054	+54 ▲
mozilla	71	127	51	42	34	0	9	0	0.0	8.1	.0031	+22 ▲
drupal	46	51	6	5	35	5	4	1	2.0	5.9	.0026	+46 ▲
gitlab	20	51	0	7	37	7	4	2	3.9	4.9	.0029	-4 ▼
github	6	12	1	3	8	0	0	0	0.0	6.0	.0042	+5 ▲
docker	0	7	0	5	2	0	0	0	0.0	8.2	.0016	-4 ▼
wordpress	3	3	1	1	1	0	2	2	66.7	8.6	.7979	+3 ▲
kubernetes	1	1	0	0	0	1	0	0	0.0	2.4	.0035	+1 ▲

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	1109	1379	343	653	322	61	27	3	0.2	8.1	.0036	+867 ▲
adobe	105	249	26	114	105	4	19	3	1.2	7.8	.0026	-27 ▼
ibm	70	194	59	69	66	0	6	0	0.0	7.5	.0034	+38 ▲
progress	33	42	6	29	7	0	6	0	0.0	8.0	.0038	+28 ▲
solarwinds	15	22	16	3	3	0	10	4	18.2	9.1	.0058	+12 ▲
zohocorp	3	6	2	2	2	0	0	0	0.0	7.8	.0146	+2 ▲
veeam	1	5	2	3	0	0	1	0	0.0	8.6	.0051	0
atlassian	3	3	0	3	0	0	13	0	0.0	8.0	.0026	+3 ▲

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
rockwell automation	17	24	4	18	2	0	0	8.7	.0029	+10 ▲
synology	0	23	2	5	13	3	0	5.6	.0025	-5 ▼
d-link	8	20	0	5	9	6	3	5.5	.0105	-2 ▼
siemens	7	16	1	8	7	0	0	7.6	.0024	0
schneider electric	3	9	1	6	2	0	0	8.6	.0037	-3 ▼
abb	1	7	0	4	3	0	0	7.2	.0018	-5 ▼
hikvision	5	5	0	3	2	0	0	7.2	.0038	+5 ▲
moxa	0	5	0	3	2	0	0	7.0	.0029	-5 ▼

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	49	120	0	0	62	58	0	0	0.0	5.5	.0034	0
openclaw	44	111	0	58	39	14	0	0	0.0	7.0	.0026	-17 ▼
dell	43	99	5	47	44	3	2	1	1.0	7.1	.0021	+5 ▲
capgo	22	83	2	42	38	1	0	0	0.0	7.1	.0037	-24 ▼
nvidia	43	82	12	54	16	0	0	0	0.0	7.8	.0037	+37 ▲
imagemagick	35	76	1	5	58	12	0	0	0.0	5.3	.0018	0
spring	0	73	2	31	39	1	0	0	0.0	6.5	.0024	-72 ▼
itsourcecode	18	71	0	0	19	52	0	0	0.0	2.1	.0033	-25 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-63030	.9779	99.9	9.8
CVE-2026-16232	.8912	99.8	9.3
CVE-2026-50522	.8461	99.7	9.8
CVE-2026-15409	.8366	99.7	10.0
CVE-2026-60137	.7979	99.6	5.9
CVE-2026-6875	.7758	99.5	9.5
CVE-2026-25089	.7611	99.5	9.8
CVE-2026-45659	.7608	99.5	8.8
CVE-2026-0770	.6342	99.1	9.8
CVE-2026-48282	.4239	98.6	10.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-15409	10.0	.8366	KEV
CVE-2026-48282	10.0	.4239	KEV
CVE-2026-56290	10.0	.3038	KEV
CVE-2026-48939	10.0	.1973	KEV
CVE-2026-48908	10.0	.1482	KEV
CVE-2026-56291	10.0	.1459	KEV
CVE-2026-59726	10.0	.0688
CVE-2026-8985	10.0	.0660
CVE-2026-13773	10.0	.0610
CVE-2026-6516	10.0	.0486

Most disclosures (vendor)
Vendor	CVEs
oracle	1109
linux	834
microsoft	665
google	503
apache	175
apple	167
red hat	146
adobe	115
ibm	113
mozilla	72

Most KEV additions (YTD)
Vendor	KEV
microsoft	24
cisco	12
apple	7
fortinet	6
google	6
ivanti	5
solarwinds	4
adobe	3
berriai	3
oracle	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	72
PyPI	6
NuGet	4
npm	4
Go	3
Packagist	2
crates.io	2

Fastest to KEV
CVE	Vendor	Days
CVE-2021-27137	DD-WRT	0
CVE-2025-68686	Fortinet	0
CVE-2026-0770	Langflow	0
CVE-2026-15409	SonicWall	0
CVE-2026-15410	SonicWall	0
CVE-2026-16232	checkpoint	0
CVE-2026-16812	Arista Networks	0
CVE-2026-20316	Cisco	0
CVE-2026-25089	Fortinet	0
CVE-2026-45659	Microsoft	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1715
CVE-2021-27102	n/a	2021-11-17	1715
CVE-2021-27101	n/a	2021-11-17	1715
CVE-2021-27103	n/a	2021-11-17	1715
CVE-2021-21017	Adobe	2021-11-17	1715
CVE-2021-28550	Adobe	2021-11-17	1715
CVE-2021-42013	Apache Software Foundation	2021-11-17	1715
CVE-2021-41773	Apache Software Foundation	2021-11-17	1715
CVE-2021-30858	Apple	2021-11-17	1715
CVE-2021-30860	Apple	2021-11-17	1715

Transactions

EXPLOIT PUBLISHED — CVE-2021-29022. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-29023. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-29024. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-36271. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-38352 (Linux). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-34632 (Adobe Photoshop Installer). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-45700 (FreeRDP). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-50289 (sebhildebrandt systeminformation). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-54497 (ViewComponent view_component). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-54498 (ViewComponent view_component). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-56821 (netty). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-59733 (rclone). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-59919 (netty). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-60113 (NASA-AMMOS AIT-DSN). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-66746 (tomaka rouille). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-66748 (owen2345 camaleon-cms). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-66754 (tomaka rouille). Public exploit reference added.

DUE DATE PASSED — CVE-2026-56155 (Microsoft Windows 10 Version 1607). CISA remediation deadline was July 28, 2026; still in catalog.

RESCORED — CVE-2024-21537 (lilconfig). CVSS 9.3 → 8.9 (NVD).

RESCORED — CVE-2026-11541 (IBM CICS Transaction Gateway for Multiplatforms). CVSS 7.4 → 9.8 (NVD).

RESCORED — CVE-2026-49181 (Microsoft Windows 10 Version 1607). CVSS 7.5 → 9.8 (NVD).

PATCH SHIPPED — CVE-2025-38352 (Linux). Fixed in Linux 5.4.295.

ENRICHED — CVE-2021-29022. Received CVSS 5.3 and CPE data from NVD.

ENRICHED — CVE-2021-29023. Received CVSS 5.3 and CPE data from NVD.

ENRICHED — CVE-2021-29024. Received CVSS 7.5 and CPE data from NVD.

ENRICHED — CVE-2026-53376 (Linux). Received CVSS 5.5 and CPE data from NVD.

ENRICHED — CVE-2026-53377 (Linux). Received CVSS 5.5 and CPE data from NVD.

Yesterday's Results

How to read these box scores · glossary

274 CVEs published. 25 box scores, 249 table rows — nothing truncated.

CVE-2026-20316MEDIUM

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .0982   95.2   YES

AFFECTED
  Product                                        Versions  Fixed
  Cisco Secure Firewall Management Center (FMC)  7.0.0 –   —

TIMELINE
  Oct 8   Reserved by CNA
  Jul 29  Added to CISA KEV, due Aug 1
  Jul 29  Published (CNA: cisco)

CWE-259 · CNA: cisco · CVSS v3.1 · 2 references · NVD status: Analyzed · KEV due August 1, 2026

CVE-2026-5492MEDIUM

DriveLock Directory Traversal Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0160   73.9     —

AFFECTED
  Product    Versions        Fixed
  DriveLock  25.2.2.61370 –  —

TIMELINE
  Apr 3   Reserved by CNA
  Jul 29  Published (CNA: zdi)

CWE-22 · CNA: zdi · CVSS v3.0 · 2 references · NVD status: Deferred

CVE-2026-5491HIGH

DriveLock Directory Traversal Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0154   73.0     —

AFFECTED
  Product    Versions        Fixed
  DriveLock  25.2.2.61370 –  —

TIMELINE
  Apr 3   Reserved by CNA
  Jul 29  Published (CNA: zdi)

CWE-22 · CNA: zdi · CVSS v3.0 · 2 references · NVD status: Deferred

CVE-2026-5487HIGH

DriveLock Directory Traversal Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0154   72.9     —

AFFECTED
  Product    Versions        Fixed
  DriveLock  25.2.2.61370 –  —

TIMELINE
  Apr 3   Reserved by CNA
  Jul 29  Published (CNA: zdi)

CWE-22 · CNA: zdi · CVSS v3.0 · 2 references · NVD status: Deferred

CVE-2026-5489MEDIUM

DriveLock Directory Traversal Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .0127   67.5     —

AFFECTED
  Product    Versions        Fixed
  DriveLock  25.2.2.61370 –  —

TIMELINE
  Apr 3   Reserved by CNA
  Jul 29  Published (CNA: zdi)

CWE-22 · CNA: zdi · CVSS v3.0 · 2 references · NVD status: Deferred

CVE-2026-67438MEDIUM

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  U  H  H  H    6.6   .0100   60.0     —

AFFECTED
  Product   Versions                    Fixed
  OliveTin  >= 3000.2.0, < 3000.17.0 –  —

TIMELINE
  Jul 29  Reserved by CNA
  Jul 29  Published (CNA: GitHub_M)

CWE-78 · CNA: GitHub_M · CVSS v3.1 · 3 references · NVD status: Deferred

CVE-2026-12935HIGH

TP-Link Systems Inc. TL-WR940N v6 — Unauthenticated Remote Code Execution in TP-Link TL-WR940N RTSP Conntrack Feature

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   H   H   H    8.7   .0091   57.3     —

AFFECTED
  Product       Versions     Fixed
  TL-WR940N v6  unspecified  —

TIMELINE
  Jun 22  Reserved by CNA
  Jul 29  Published (CNA: TPLink)

CWE-121 · CNA: TPLink · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-18072CRITICAL

nico23 Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … — Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0088   56.3     —

AFFECTED
  Product                                                                        Versions  Fixed
  Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …  10.8.7 –  —

TIMELINE
  Jul 28  Reserved by CNA
  Jul 29  Published (CNA: Wordfence)

CWE-506 · CNA: Wordfence · CVSS v3.1 · 5 references · NVD status: Deferred

CVE-2026-41939CRITICAL

Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0080   53.9     —

AFFECTED
  Product                  Versions   Fixed
  Care Everywhere Gateway  14.3.10 –  —

TIMELINE
  Apr 22  Reserved by CNA
  Jul 29  Published (CNA: VulnCheck)

CWE-1392 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Deferred

CVE-2026-14266HIGH

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  H  H  H    7.8   .0074   51.9     —

AFFECTED
  Product  Versions  Fixed
  7-Zip    26.01 –   —

TIMELINE
  Jun 30  Reserved by CNA
  Jul 29  Published (CNA: zdi)

CWE-122 · CNA: zdi · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-12357HIGH

Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0073   51.3     —

AFFECTED
  Product         Versions       Fixed
  Database Proxy  25.03.01.21 –  —

TIMELINE
  Jun 15  Reserved by CNA
  Jul 29  Published (CNA: zdi)

CWE-93 · CNA: zdi · CVSS v3.0 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-65883CRITICAL

aimy-extensions.com Aimy Captcha-Less Form Guard plugin for Joomla — Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H   10.0   .0071   50.7     —

AFFECTED
  Product                                         Versions     Fixed
  Aimy Captcha-Less Form Guard plugin for Joomla  18.0-20.0 –  —

TIMELINE
  Jul 23  Reserved by CNA
  Jul 29  Published (CNA: Joomla)

CWE-502 · CNA: Joomla · CVSS v4.0 · 1 reference · NVD status: Analyzed

CVE-2026-14900CRITICAL

StylemixThemes Cost Calculator Builder PRO — Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0069   50.0     —

AFFECTED
  Product                      Versions     Fixed
  Cost Calculator Builder PRO  unspecified  —

TIMELINE
  Jul 6   Reserved by CNA
  Jul 29  Published (CNA: Wordfence)

CWE-94 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-67192CRITICAL

Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   H   H    9.2   .0066   48.7     —

AFFECTED
  Product            Versions     Fixed
  Xlight FTP Server  unspecified  —

TIMELINE
  Jul 28  Reserved by CNA
  Jul 29  Published (CNA: VulnCheck)

CWE-121 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-67191CRITICAL

Xlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH Parser

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0062   46.8     —

AFFECTED
  Product            Versions     Fixed
  Xlight FTP Server  unspecified  —

TIMELINE
  Jul 28  Reserved by CNA
  Jul 29  Published (CNA: VulnCheck)

CWE-122 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-12476HIGH

smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy — Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0061   46.6     —

AFFECTED
  Product                                                                  Versions     Fixed
  Easy Digital Downloads – eCommerce Payments and Subscriptions made easy  unspecified  —

TIMELINE
  Jun 16  Reserved by CNA
  Jul 29  Published (CNA: Wordfence)

CWE-434 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Deferred

CVE-2026-13308HIGH

Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .0057   44.4     —

AFFECTED
  Product                    Versions   Fixed
  MaxiCharger AC Elite Home  1.39.51 –  —

TIMELINE
  Jun 25  Reserved by CNA
  Jul 29  Published (CNA: zdi)

CWE-191 · CNA: zdi · CVSS v3.0 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-13423CRITICAL

Unknown Streamit — Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0054   42.8     —

AFFECTED
  Product   Versions     Fixed
  Streamit  unspecified  —

TIMELINE
  Jun 26  Reserved by CNA
  Jul 29  Published (CNA: WPScan)

CWE-94 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-14270HIGH

ThemeComplete Extra Checkout Options - addon for Extra Product Options plugin — Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0053   42.5     —

AFFECTED
  Product                                                          Versions     Fixed
  Extra Checkout Options - addon for Extra Product Options plugin  unspecified  —

TIMELINE
  Jun 30  Reserved by CNA
  Jul 29  Published (CNA: Wordfence)

CWE-434 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-60112CRITICAL

NASA-AMMOS AIT-GUI — AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0053   42.3     —

AFFECTED
  Product  Versions     Fixed
  AIT-GUI  unspecified  —

TIMELINE
  Jul 8   Reserved by CNA
  Jul 29  Published (CNA: VulnCheck)

CWE-306 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Analyzed

CVE-2026-67595CRITICAL

webreinvent vaahcms — VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   H   H    9.2   .0053   42.3     —

AFFECTED
  Product  Versions  Fixed
  vaahcms  2.0.0 –   8d7898f7a385a5fade1180a9b664ff158d873129

TIMELINE
  Jul 29  Reserved by CNA
  Jul 29  Published (CNA: VulnCheck)

CWE-506 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Deferred

CVE-2026-60113CRITICAL

NASA-AMMOS AIT-DSN — AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0053   42.1     —

AFFECTED
  Product  Versions     Fixed
  AIT-DSN  unspecified  —

TIMELINE
  Jul 8   Reserved by CNA
  Jul 29  Public exploit reference published
  Jul 29  Published (CNA: VulnCheck)

CWE-306 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Analyzed

CVE-2026-58151HIGH

Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0052   42.0     —

AFFECTED
  Product                Versions  Fixed
  Apache Traffic Server  8.0.0 –   —

TIMELINE
  Jun 29  Reserved by CNA
  Jul 29  Published (CNA: apache)

CWE-400 · CNA: apache · CVSS v4.0 · 1 reference · NVD status: Analyzed

CVE-2026-65324HIGH

Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   N   N   H    8.2   .0052   42.0     —

AFFECTED
  Product                Versions  Fixed
  Apache Traffic Server  8.0.0 –   —

TIMELINE
  Jul 21  Reserved by CNA
  Jul 29  Published (CNA: apache)

CWE-400 · CNA: apache · CVSS v4.0 · 1 reference · NVD status: Analyzed

CVE-2026-23904HIGH

Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  L    7.3   .0052   42.1     —

AFFECTED
  Product        Versions  Fixed
  Apache Kyuubi  1.8.0 –   —

TIMELINE
  Jan 19  Reserved by CNA
  Jul 29  Published (CNA: apache)

CWE-923 · CNA: apache · CVSS v3.1 · 3 references · NVD status: Analyzed

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-66723	7.0	40.2	CERT.PL	MWDB Core	CWE-862	Missing authentication requirement in Remote Instances proxy API in MWDB Core
CVE-2026-11974	8.6	39.8	Unknown	wp-media-folder-addon	CWE-22	Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download
CVE-2026-67429	10.0	39.8	flytohub	flyto-core	CWE-22	Flyto2 Core: Arbitrary file write via image.download (and other file-writing …
CVE-2026-5057	7.5	39.5	ATEN	Unizon	CWE-306	ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability
CVE-2026-5490	8.8	39.3	DriveLock	DriveLock	CWE-89	DriveLock SQL Injection Privilege Escalation Vulnerability
CVE-2026-15975	7.5	38.8	GitLab	GitLab	CWE-770	Allocation of Resources Without Limits or Throttling in GitLab
CVE-2026-13723	6.5	38.2	Develar	app-builder	CWE-22	Develar's electron-builder allows arbitrary file overwrite
CVE-2026-13697	9.1	38.1	undici	undici	CWE-200	undici vulnerable to cross-user information disclosure and parse-time crash v…
CVE-2026-67215	8.7	38.1	DaveGamble	cJSON	CWE-674	cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion
CVE-2026-58153	6.3	38.1	Apache Software Foundation	Apache Traffic Server	CWE-444	Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers t…
CVE-2026-59243	9.8	36.9	Apache Software Foundation	Apache Airflow FAB provider	CWE-347	Apache Airflow FAB provider: FAB auth manager: JWT signature verification dis…
CVE-2026-58161	9.2	36.6	Apache Software Foundation	Apache Traffic Server	CWE-476	Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash…
CVE-2026-58188	8.4	35.8	Apache Software Foundation	Apache Traffic Server	CWE-787	Apache Traffic Server: Memory-safety and limit-bypass errors across experimen…
CVE-2026-67432	7.5	35.6	modelcontextprotocol	ruby-sdk	CWE-770	MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allo…
CVE-2026-67216	8.2	35.3	DaveGamble	cJSON	CWE-407	cJSON cJSON_Compare Exponential Complexity Denial of Service
CVE-2026-54680	9.9	35.3	kube-logging	logging-operator	CWE-74	Logging operator has Fluentd configuration injection that allows remote code …
CVE-2026-58182	8.2	35.1	Apache Software Foundation	Apache Traffic Server	CWE-400	Apache Traffic Server: ts_lua plugin has initialization and resource-handling…
CVE-2026-46678	5.9	34.6	pydantic	pydantic-ai	CWE-918	Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incom…
CVE-2026-58160	6.3	34.5	Apache Software Foundation	Apache Traffic Server	CWE-125	Apache Traffic Server: Out-of-bounds reads while parsing DNS responses
CVE-2026-58186	8.2	34.4	Apache Software Foundation	Apache Traffic Server	CWE-20	Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels d…
CVE-2026-22068	6.9	33.8	Apache Software Foundation	Apache Traffic Server	CWE-777	Apache Traffic Server: Regex mappings match with malicious domain names
CVE-2026-58155	9.2	33.3	Apache Software Foundation	Apache Traffic Server	CWE-444	Apache Traffic Server: Header-name length truncation enables header aliasing …
CVE-2026-58175	8.2	32.9	Apache Software Foundation	Apache Traffic Server	CWE-401	Apache Traffic Server: HostDB SRV handling leaks memory
CVE-2026-58178	8.2	32.9	Apache Software Foundation	Apache Traffic Server	CWE-674	Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-si…
CVE-2026-58180	8.2	32.9	Apache Software Foundation	Apache Traffic Server	CWE-121	Apache Traffic Server: txn_box plugin overflows the stack from attacker input
CVE-2026-64560	7.8	32.7	Linux	Linux	—	posix-cpu-timers: Prevent UAF caused by non-leader exec() race
CVE-2026-58154	9.2	32.7	Apache Software Foundation	Apache Traffic Server	CWE-787	Apache Traffic Server: Memory-safety errors in MIME and header parsing
CVE-2026-5056	7.8	32.6	GStreamer	GStreamer	CWE-121	GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerabi…
CVE-2026-14529	9.8	32.4	IBM	WebSphere Application Server	CWE-306	IBM WebSphere Application Server and WebSphere Application Server Liberty are…
CVE-2026-58164	8.3	32.0	Apache Software Foundation	Apache Traffic Server	CWE-416	Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause u…
CVE-2026-58181	8.2	32.0	Apache Software Foundation	Apache Traffic Server	CWE-121	Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack …
CVE-2026-58183	8.2	31.8	Apache Software Foundation	Apache Traffic Server	CWE-20	Apache Traffic Server: prefetch plugin can crash on attacker-influenced input
CVE-2026-67201	7.7	31.9	vlang	v	CWE-436	V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http
CVE-2026-11973	4.9	31.3	wp-lab	WP-Lister Lite for eBay	CWE-89	WP-Lister Lite for eBay <= 3.8.8 - Authenticated (Shop Manager+) SQL Injectio…
CVE-2026-18191	9.3	31.1	Vacron	VIN-DS783E-E6	CWE-912	Vacron｜IP Camera - Hidden Functionality
CVE-2026-58163	8.3	31.0	Apache Software Foundation	Apache Traffic Server	CWE-502	Apache Traffic Server: Cache deserialization and lifetime errors can corrupt …
CVE-2026-33930	8.2	30.8	Apache Software Foundation	Apache Traffic Server	CWE-121	Apache Traffic Server: Buffer overflow via Host field that has a long string …
CVE-2026-18192	7.1	30.8	Vacron	VIN-DS783E-E6	CWE-23	Vacron｜IP Camera - Arbitrary File Read
CVE-2026-57834	7.0	30.7	Apache Software Foundation	Apache Traffic Server	CWE-444	Apache Traffic Server: Malformed chunked message body allows request smuggling
CVE-2026-18236	9.3	30.4	Google	Google-ADK	CWE-863	Google-ADK Continuation Forgery
CVE-2026-33267	7.7	30.3	Apache Software Foundation	Apache Traffic Server	CWE-20	Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata
CVE-2026-0667	9.3	29.6	Schneider Electric	SCADAPack 47x	CWE-754	CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability t…
CVE-2026-58150	7.8	29.3	Apache Software Foundation	Apache Traffic Server	CWE-444	Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejecte…
CVE-2026-58179	9.2	29.3	Apache Software Foundation	Apache Traffic Server	CWE-121	Apache Traffic Server: regex_remap plugin overflows the stack from attacker i…
CVE-2026-65886	9.2	29.1	balbooa.com	Gridbox extension for Joomla	CWE-22	Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridb…
CVE-2025-10656	9.8	28.9	holest	Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light	CWE-863	Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37…
CVE-2026-58189	8.2	28.6	Apache Software Foundation	Apache Traffic Server	CWE-918	Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amp…
CVE-2026-67427	8.6	28.5	flytohub	flyto-core	CWE-522	Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get be…
CVE-2026-12144	8.8	28.4	saadiqbal	Wholesale for WooCommerce	CWE-269	Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escala…
CVE-2026-65100	6.3	28.1	Apache Software Foundation	Apache Traffic Server	CWE-696	Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a …
CVE-2026-67437	7.5	27.6	OliveTin	OliveTin	CWE-400	OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded M…
CVE-2026-58184	8.3	27.5	Apache Software Foundation	Apache Traffic Server	CWE-787	Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory
CVE-2026-50782	7.5	27.5	n/a	n/a	CWE-611	Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in…
CVE-2026-54735	10.0	27.1	prebid	prebid-server	CWE-918	prebid-server's request forgery vulnerability allows for possible host enviro…
CVE-2026-58158	8.2	27.0	Apache Software Foundation	Apache Traffic Server	CWE-121	Apache Traffic Server: PROXY protocol parsing has port truncation and a stack…
CVE-2026-58152	6.9	27.0	Apache Software Foundation	Apache Traffic Server	CWE-190	Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrup…
CVE-2026-58187	6.3	27.0	Apache Software Foundation	Apache Traffic Server	CWE-787	Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of s…
CVE-2026-15344	4.9	27.1	opajaap	WP Photo Album Plus	CWE-89	WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Inject…
CVE-2026-54693	8.2	26.8	zitadel	zitadel	CWE-863	ZITADEL Users Can Self-Verify Email/Phone via API
CVE-2026-58185	8.2	26.2	Apache Software Foundation	Apache Traffic Server	CWE-416	Apache Traffic Server: Use-after-free in the intercept plugin
CVE-2026-67428	8.5	26.1	flytohub	flyto-core	CWE-918	Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs withou…
CVE-2026-50622	8.8	26.0	Apache Software Foundation	Apache Atlas	CWE-862	Apache Atlas: Missing Authorization on Admin Endpoints
CVE-2026-59899	6.9	25.9	netty	netty	CWE-770	Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 …
CVE-2026-18022	8.8	25.8	n/a	pgvector	CWE-190	pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-…
CVE-2026-6267	5.3	25.7	GitLab	GitLab	CWE-201	Insertion of Sensitive Information Into Sent Data in GitLab
CVE-2026-67214	8.2	25.3	nanoid_project	nanoid	CWE-835	nanoid Infinite Loop via Negative Size in non-secure module
CVE-2026-44943	6.9	25.4	open-iscsi	open-iscsi	CWE-22	remote limited file-write as root via discovery in open-iscsi
CVE-2026-63227	9.9	25.1	An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server.	Koollab LMS	CWE-434	Unrestricted SCORM file upload vulnerability
CVE-2026-58177	8.3	25.0	Apache Software Foundation	Apache Traffic Server	CWE-787	Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts …
CVE-2026-24033	6.9	24.9	Apache Software Foundation	Apache Traffic Server	CWE-444	Apache Traffic Server: Request smuggling via chunked extension quoted-string …
CVE-2026-14341	4.9	24.9	GitLab	GitLab	CWE-862	Missing Authorization in GitLab
CVE-2026-54078	8.7	24.2	veraPDF	veraPDF-validation	CWE-611	veraPDF Validation XXE via Rich Text
CVE-2026-54079	8.7	24.2	veraPDF	veraPDF-validation	CWE-611	veraPDF Validation XXE via XFA
CVE-2026-67425	8.6	24.2	flytohub	flyto-core	CWE-201	Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url
CVE-2026-67213	8.2	24.1	nanoid_project	nanoid	CWE-835	nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customR…
CVE-2026-58159	7.0	23.9	Apache Software Foundation	Apache Traffic Server	CWE-863	Apache Traffic Server: Listener and ACL handling allow access-control bypass
CVE-2026-12436	8.4	23.1	GitLab	GitLab	CWE-915	Improperly Controlled Modification of Dynamically-Determined Object Attribute…
CVE-2026-41920	7.0	23.0	Apache Software Foundation	Apache Traffic Server	CWE-284	Apache Traffic Server: SNI to Host header matching policy is not properly enf…
CVE-2026-67426	9.3	22.9	flytohub	flyto-core	CWE-306	Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and i…
CVE-2026-67430	5.3	22.9	modelcontextprotocol	ruby-sdk	CWE-401	MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows m…
CVE-2026-14488	9.1	22.8	Meta Box	Meta Box AIO	CWE-862	Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Po…
CVE-2026-67194	7.1	22.6	svarshavchik	Courier IMAP	CWE-674	Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH…
CVE-2026-14643	7.5	22.4	undici	undici	CWE-436	undici vulnerable to cross-user information disclosure via whitespace around …
CVE-2026-16655	7.2	22.4	wpmanageninja	Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder	CWE-79	Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name …
CVE-2026-54080	6.9	22.2	veraPDF	veraPDF-parser	CWE-1325	veraPDF Parser DoS via PostScript CMap Streams
CVE-2026-54081	6.9	22.2	veraPDF	veraPDF-parser	CWE-1325	veraPDF Parser DoS via PostScript Type 1 Font Programs
CVE-2026-65887	10.0	22.1	balbooa.com	Gridbox extension for Joomla	CWE-284	Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in …
CVE-2026-8338	9.2	22.0	Black Duck	Coverity Connect	CWE-288	Authentication and Authorization Bypass in Coverity Connect
CVE-2026-50642	4.8	22.0	so-fancy	diff-so-fancy	CWE-116	Terminal Escape Injection in diff‑so‑fancy
CVE-2026-16326	10.0	21.9	HashiCorp	Tooling	CWE-488	consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-H…
CVE-2026-67217	6.9	21.8	DaveGamble	cJSON	CWE-696	cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation
CVE-2026-63229	9.1	21.6	Three Learning	Koollab LMS	CWE-89	Pre-authentication blind SQL injection vulnerability
CVE-2026-63230	9.1	21.6	Three Learning	Koollab LMS	CWE-89	Pre-authentication error-based SQL injection vulnerability
CVE-2026-18220	7.8	21.6	Red Hat	Red Hat Enterprise Linux 10	CWE-787	Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation pro…
CVE-2026-16751	6.5	21.5	Ente	Museum Server	—	Ente Museum Server Authorization Bypass Vulnerability
CVE-2026-14351	4.3	21.4	GitLab	GitLab	CWE-1230	Exposure of Sensitive Information Through Metadata in GitLab
CVE-2026-63232	9.9	21.4	Three Learning	Koollab LMS	CWE-89	SQL injection and unsafe deserialisation vulnerability
CVE-2026-63233	9.9	21.4	Three Learning	Koollab LMS	CWE-89	SQL injection and unsafe deserialisation vulnerability
CVE-2026-63234	9.9	21.4	Three Learning	Koollab LMS	CWE-89	SQL injection and unsafe deserialisation vulnerability
CVE-2026-65885	9.4	21.2	balbooa.com	Gridbox extension for Joomla	CWE-434	Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridb…
CVE-2026-67431	8.3	21.2	modelcontextprotocol	ruby-sdk	CWE-284	MCP Ruby SDK: Ruby SSE Session Poisoning
CVE-2026-13346	5.6	21.2	Python Packaging Authority	pip	CWE-36	pip absolute path traversal during download from malicious package indexes
CVE-2026-65888	10.0	21.0	balbooa.com	Gridbox extension for Joomla	CWE-284	Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < …
CVE-2026-65889	9.2	21.0	balbooa.com	Gridbox extension for Joomla	CWE-284	Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion…
CVE-2026-9177	9.4	20.8	Axway	SecureTransport	CWE-1336	Server-Side Template Injection in SecureTransport's Apache Velocity mail temp…
CVE-2026-54666	8.3	20.5	acacode	swagger-typescript-api	CWE-74	swagger-typescript-api vulnerable to code injection via unescaped OpenAPI pat…
CVE-2026-67435	6.0	20.6	Linuxfabrik	monitoring-plugins	CWE-200	linuxfabrik-lib: fetch() forwards credential headers across a cross-origin re…
CVE-2026-4672	4.3	20.5	GitLab	GitLab	CWE-862	Missing Authorization in GitLab
CVE-2026-65884	10.0	20.4	balbooa.com	Gridbox extension for Joomla	CWE-284	Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2
CVE-2026-65890	9.2	20.1	balbooa.com	Gridbox extension for Joomla	CWE-89	Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2…
CVE-2026-67193	6.9	20.1	Xlight	Xlight FTP Server	CWE-203	Xlight FTP Server < 3.9.5 Information Disclosure via USER Command
CVE-2025-69943	9.8	19.5	n/a	n/a	CWE-89	kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in ge…
CVE-2026-58157	6.9	19.2	Apache Software Foundation	Apache Traffic Server	CWE-200	Apache Traffic Server: Improper server-session reuse can expose data across c…
CVE-2026-18255	7.2	19.0	Red Hat	Red Hat Quay 3	CWE-863	Quay: quay: global read-only superuser can view robot account tokens
CVE-2026-54661	8.3	18.7	acacode	swagger-typescript-api	CWE-74	swagger-typescript-api vulnerable to code injection via unescaped `servers[0]…
CVE-2026-54662	8.3	18.7	acacode	swagger-typescript-api	CWE-74	swagger-typescript-api vulnerable to code injection via unescaped `servers[0]…
CVE-2026-54664	8.3	18.7	acacode	swagger-typescript-api	CWE-74	swagger-typescript-api vulnerable to code injection via unescaped enum string…
CVE-2026-6089	4.9	18.6	blendmedia	WP CTA – Call Now Button, Sticky Button & Call to Action Builder	CWE-918	WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery
CVE-2026-66724	5.3	18.5	CERT.PL	MWDB Core	CWE-862	Permission Bypass Via Undocumented HTTP Methods In MWDB Core
CVE-2026-59901	8.7	17.7	netty	netty	CWE-835	Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Th…
CVE-2025-65340	9.8	17.3	n/a	n/a	CWE-89	kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /…
CVE-2025-67403	9.8	17.3	n/a	n/a	CWE-89	Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Inj…
CVE-2025-67404	9.8	17.3	n/a	n/a	CWE-89	Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Inj…
CVE-2025-69942	9.8	17.4	n/a	n/a	CWE-89	kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /…
CVE-2026-6336	5.3	16.7	GitLab	GitLab	CWE-863	Incorrect Authorization in GitLab
CVE-2026-13690	7.4	16.6	Unknown	UsersWP	CWE-287	UsersWP < 1.2.67 - Two-Factor Authentication Bypass
CVE-2026-65891	6.5	16.7	joomlacontenteditor.net	Joomla Content Editor (JCE) extension for Joomla	CWE-20	Joomla Extension - joomlacontenteditor.net - Creation of hidden files and uni…
CVE-2026-16553	5.4	16.6	GitLab	GitLab	CWE-522	Insufficiently Protected Credentials in GitLab
CVE-2026-67439	4.3	16.4	OliveTin	OliveTin	CWE-863	OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Ac…
CVE-2026-55995	8.7	16.3	open-iscsi	open-iscsi	CWE-415	Double-free in the iSNS attribute decoder in open-iscsi
CVE-2026-63231	8.1	16.4	Three Learning	Koollab LMS	CWE-89	Post-authentication SQL injection vulnerability
CVE-2026-15077	4.3	16.2	GitLab	GitLab	CWE-74	Improper Neutralization of Input Used for LLM Prompting in GitLab
CVE-2026-50558	5.9	16.1	brightio	penelope	CWE-22	Penelope unsafe tar extraction allows arbitrary local file write via crafted …
CVE-2026-67436	8.3	16.0	Linuxfabrik	monitoring-plugins	CWE-20	Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidate…
CVE-2026-59898	6.3	16.0	netty	netty	CWE-444	Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
CVE-2026-13425	7.2	15.9	code4life	Database for CF7	CWE-79	Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via A…
CVE-2026-58156	6.3	15.9	Apache Software Foundation	Apache Traffic Server	CWE-863	Apache Traffic Server: URL and port parsing errors allow access-control bypass
CVE-2026-18266	5.4	15.9	LangGenius	Dify	CWE-601	Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability
CVE-2026-15144	5.3	15.7	@fastify/rate-limit	@fastify/rate-limit	CWE-307	@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation
CVE-2026-54660	7.4	15.3	acacode	swagger-typescript-api	CWE-200	swagger-typescript-api vulnerable to authorization-token exfiltration via spe…
CVE-2026-64557	8.8	14.9	Linux	Linux	—	Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
CVE-2026-16597	7.2	15.0	duracelltomi	GTM4WP – A Google Tag Manager (GTM) plugin for WordPress	CWE-79	GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerc…
CVE-2026-33385	5.1	14.9	OpenSolution	Quick.CMS	CWE-89	Blind SQL Injection in Quick.CMS
CVE-2026-14300	8.1	14.7	Unknown	miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)	CWE-287	miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
CVE-2026-59920	6.5	14.7	netty	netty	CWE-93	Netty: STOMP CONNECT Frame Header Injection
CVE-2026-67424	8.5	14.4	flytohub	flyto-core	CWE-918	Flyto2 Core: Guarded HTTP modules follow redirects into internal space withou…
CVE-2026-4604	5.3	14.2	klubraum	Klubraum Membership Request	CWE-862	Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticat…
CVE-2026-3093	4.7	14.2	GitLab	GitLab	CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scri…
CVE-2026-12703	8.0	14.1	TeamViewer	Remote	CWE-288	Bypass of 2FA for Connections via Unattended Access in TeamViewer for macOS
CVE-2026-8791	6.4	14.1	ameliabooking	Booking System Trafft	CWE-79	Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Si…
CVE-2026-16328	8.6	13.9	HashiCorp	Tooling	CWE-918	consul-mcp-server vulnerable to server side request forgery leading to token …
CVE-2025-60931	7.5	13.9	n/a	n/a	CWE-639	An Insecure Direct Object Reference (IDOR) in the Employee Compensation View …
CVE-2026-65943	7.5	13.9	rolandd.com	RO CSVI extension for Joomla	CWE-284	Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI <…
CVE-2026-59900	6.9	13.9	netty	netty	CWE-444	Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Trans…
CVE-2026-54082	6.5	13.6	veraPDF	veraPDF-validation	CWE-611	veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When …
CVE-2026-13605	6.8	13.4	Unknown	PhotoSwipe	CWE-79	Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute
CVE-2026-13307	6.8	13.3	Autel	MaxiCharger AC Elite Home	CWE-122	Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code…
CVE-2026-13309	6.8	13.3	Autel	MaxiCharger AC Elite Home	CWE-121	Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Cod…
CVE-2026-58162	8.4	12.9	Apache Software Foundation	Apache Traffic Server	CWE-295	Apache Traffic Server: Certifier plugin trusts client SNI when generating cer…
CVE-2026-17166	4.3	13.0	magepeopleteam	Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar	CWE-862	Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Aut…
CVE-2025-14562	3.1	12.9	GitLab	GitLab	CWE-863	Incorrect Authorization in GitLab
CVE-2026-18207	6.5	12.6	Red Hat	Red Hat Build of Keycloak	CWE-285	Keycloak-services: keycloak-services: client policy source-group condition by…
CVE-2026-15831	4.3	12.5	GitLab	GitLab	CWE-1270	Generation of Incorrect Security Tokens in GitLab
CVE-2026-18201	5.5	11.9	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: generic identity-provider creation can …
CVE-2026-12895	7.1	11.8	Frappe	ERPNext	CWE-89	SQL Injection in Frappe's ERPNext
CVE-2026-63238	6.5	11.9	Three Learning	Koollab LMS	CWE-287	Authentication bypass vulnerability
CVE-2026-5060	6.5	11.6	stylemix	MasterStudy LMS WordPress Plugin – for Online Courses and Education	CWE-639	MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14…
CVE-2026-54705	6.3	10.9	arnog	mathlive	CWE-116	mathlive's Lack of Escaping of HTML allows for XSS
CVE-2026-12938	6.4	10.6	contrid	Newsletters	CWE-79	Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scriptin…
CVE-2026-12939	6.4	10.6	contrid	Newsletters	CWE-79	Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scriptin…
CVE-2026-11351	5.3	10.6	Unknown	ShinyStat Analytics	CWE-200	ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Informat…
CVE-2026-66489	5.3	10.4	balbooa.com	Gridbox extension for Joomla	CWE-200	Joomla Extension - balbooa.com - Various unauthenticated file system disclosu…
CVE-2026-66488	5.3	10.3	balbooa.com	Gridbox extension for Joomla	CWE-285	Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
CVE-2026-8339	8.7	10.2	Black Duck	Coverity Connect	CWE-89	SQL Injection in Coverity Connect SOAP API
CVE-2025-67406	7.3	10.1	n/a	n/a	CWE-89	https://www.sourcecodester.com Advocate office management system 1.0 is affec…
CVE-2026-13113	5.3	9.8	GitLab	GitLab	CWE-367	Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
CVE-2026-5626	4.3	9.7	bplugins	Survey Form Block – collect answers and insights from your audience	CWE-862	Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscrib…
CVE-2026-64685	5.3	9.5	ImageMagick	ImageMagick	CWE-125	ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file c…
CVE-2026-54249	6.8	9.4	pydantic	pydantic-ai	CWE-918	VercelAIAdapter trusts client-controlled `providerMetadata` to construct `Upl…
CVE-2026-65975	6.5	9.4	pydantic	pydantic-ai	CWE-863	Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute …
CVE-2026-63235	3.7	9.3	Three Learning	Koollab LMS	CWE-284	Improper access control vulnerability
CVE-2026-63118	6.9	9.2	modelcontextprotocol	ruby-sdk	CWE-346	MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) pro…
CVE-2026-15157	5.4	8.9	undici	undici	CWE-93	undici vulnerable to CRLF Injection via blob-like body 'type' property
CVE-2026-18174	5.3	8.9	@fastify/forwarded	@fastify/forwarded	CWE-20	@fastify/forwarded vulnerable to improper input validation via unstripped tab…
CVE-2026-16729	6.5	8.7	undici	undici	CWE-74	undici vulnerable to cookie attribute injection via unsanitized domain and un…
CVE-2026-16463	7.8	8.6	Autodesk	AutoCAD	CWE-122	DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD
CVE-2026-7436	6.4	8.4	wpclever	WPC Badge Management for WooCommerce	CWE-79	WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) …
CVE-2026-15735	6.4	8.4	itpathsolutions	Contact Form to Any API	CWE-79	Contact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-…
CVE-2026-17161	6.4	8.4	wpxpo	WowStore – Store Builder & Product Blocks for WooCommerce	CWE-79	WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting…
CVE-2026-17162	6.4	8.4	wpxpo	WowStore – Store Builder & Product Blocks for WooCommerce	CWE-79	WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting…
CVE-2026-13306	4.3	7.8	Autel	MaxiCharger AC Elite Home	CWE-306	Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability
CVE-2026-13692	5.3	7.7	Unknown	PayU CommercePro Plugin	CWE-862	PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering
CVE-2026-54663	6.1	7.7	acacode	swagger-typescript-api	CWE-20	swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
CVE-2026-16465	7.1	7.4	Autodesk	AutoCAD	CWE-125	DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD
CVE-2025-69949	7.3	7.1	n/a	n/a	CWE-89	kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in c…
CVE-2026-16728	6.5	7.1	undici	undici	CWE-444	undici vulnerable to downstream response desynchronization via retry interceptor
CVE-2026-17550	5.5	7.1	Autodesk	AutoCAD	CWE-125	DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD
CVE-2026-63240	4.3	7.1	Three Learning	Koollab LMS	CWE-200	Information disclosure vulnerability
CVE-2026-35226	7.1	6.7	CODESYS	CODESYS PROFINET	CWE-787	Out-of-bounds Write in CODESYS PROFINET Controller
CVE-2025-67405	7.3	6.4	n/a	n/a	CWE-89	Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Inj…
CVE-2025-67407	7.3	6.4	n/a	n/a	CWE-89	Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Inj…
CVE-2025-67408	7.3	6.4	n/a	n/a	CWE-89	Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Inj…
CVE-2025-69944	7.3	6.4	n/a	n/a	CWE-89	kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in t…
CVE-2025-69945	7.3	6.4	n/a	n/a	CWE-89	kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /…
CVE-2026-63236	3.7	6.1	Three Learning	Koollab LMS	CWE-284	Improper access control vulnerability
CVE-2026-12927	8.4	5.3	Schneider Electric	IGSS Definition (Def.exe)	CWE-787	CWE-787 Out-of-bounds write vulnerability exists that could cause loss of dat…
CVE-2026-50641	7.1	5.4	Streamsoft	Business Intelligence	CWE-256	Plaintext password storage in Streamsoft Business Intelligence
CVE-2026-18197	6.4	5.0	—	Link Library	CWE-79	Improper neutralization of input during web page generation ('cross-site scri…
CVE-2026-65325	6.3	4.9	Apache Software Foundation	Apache Traffic Server	CWE-295	Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without …
CVE-2025-65337	6.1	4.8	n/a	n/a	CWE-79	Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (…
CVE-2026-66490	6.1	4.8	balbooa.com	Gridbox extension for Joomla	CWE-79	Joomla Extension - balbooa.com - Stored cross-site scripting via a comment av…
CVE-2026-56389	6.8	4.8	GNU	Bison	CWE-78	Arbitrary Command Execution in GNU Bison
CVE-2026-66400	6.3	4.6	getgrav	grav	CWE-613	Grav Login Plugin before 3.8.13 Insufficient Session Expiration
CVE-2026-63242	4.3	4.6	Three Learning	Koollab LMS	CWE-639	Business logic vulnerability
CVE-2026-13268	7.8	4.5	G DATA	Total Security	CWE-59	G DATA Total Security Backup Service Link Following Local Privilege Escalatio…
CVE-2026-65946	6.1	4.3	rolandd.com	RO CSVI extension for Joomla	CWE-79	Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSV…
CVE-2026-54574	8.2	4.0	termux	proot-distro	CWE-61	`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via M…
CVE-2026-14224	5.4	3.7	Unknown	Easy Appointments	CWE-639	Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modific…
CVE-2026-15228	7.1	3.6	—	Kong/kubernetes-ingress-controller	CWE-400	Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via…
CVE-2026-16543	7.1	3.6	—	Kong/kong-operator	CWE-400	Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-cert…
CVE-2026-63241	3.1	3.6	Three Learning	Koollab LMS	CWE-639	Insecure direct object reference vulnerability
CVE-2026-59919	5.5	3.5	netty	netty	CWE-93	Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
CVE-2026-56390	4.6	3.0	GNU	Bison	CWE-73	Arbitrary Output Location Change in GNU Bison
CVE-2026-65944	8.8	2.9	rolandd.com	RO CSVI extension for Joomla	CWE-352	Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CS…
CVE-2026-59247	7.6	2.6	gleam-lang	gleam	CWE-345	Insufficient verification of Hex package metadata in Gleam
CVE-2026-9720	4.3	2.7	facturadorvirtual	Facturación Electrónica Costa Rica	CWE-352	Facturación Electrónica Costa Rica <= 2.0.2 - Cross-Site Request Forgery to P…
CVE-2026-63228	2.6	2.7	Three Learning	Koollab LMS	CWE-434	Unrestricted image upload vulnerability
CVE-2026-63119	6.2	2.6	modelcontextprotocol	ruby-sdk	CWE-400	MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhau…
CVE-2026-65947	7.3	2.5	balbooa.com	Gridbox extension for Joomla	CWE-352	Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface …
CVE-2026-64556	7.8	2.4	Linux	Linux	—	perf/core: Detach event groups during remove_on_exec
CVE-2026-63239	5.4	2.2	Three Learning	Koollab LMS	CWE-798	Hard-coded AWS IAM credentials vulnerability
CVE-2026-54727	8.2	2.1	termux	proot-distro	CWE-668	proot-distro has a Container Isolation Bypass via Crafted Restore Archive
CVE-2026-13305	6.4	2.1	Autel	MaxiCharger AC Elite Home	CWE-347	Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryp…
CVE-2026-64558	7.8	2.0	Linux	Linux	—	s390/pkey: Check length in pkey_pckmo handler implementation
CVE-2026-64559	7.8	2.0	Linux	Linux	—	s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
CVE-2026-14354	8.7	1.8	Schneider Electric	EcoStruxure™ Cybersecurity Admin Expert	CWE-522	CWE-522 Insufficiently Protected Credentials vulnerability exists that could …
CVE-2026-63237	4.8	1.8	Three Learning	Koollab LMS	CWE-347	TOTP two-factor authentication bypass vulnerability
CVE-2026-40272	7.0	1.5	BlackBerry Ltd	QNX Software Development Platform	CWE-1284	Vulnerability in the QNX libtraceparser Impacts QNX Software Development Plat…
CVE-2026-62995	2.3	1.2	authlib	joserfc	CWE-345	joserfc accepts JWT with padding, leading to JWT malleability
CVE-2026-52791	2.0	1.0	containers	fuse-overlayfs	CWE-266	fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)
CVE-2026-18257	5.6	0.9	Systerel	S2OPC	CWE-295	Improper Certificate Validation in S2OPC
CVE-2026-10684	3.0	0.9	zephyrproject	zephyr	CWE-125	Out-of-bounds read in coredump shell when printing stored-dump target code
CVE-2026-14234	7.1	0.9	Unknown	WOLF	CWE-79	WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
CVE-2026-2482	8.8	0.9	IBM	WebSphere Application Server - Liberty	CWE-352	IBM WebSphere Application Server Liberty is affected by a cross-site request …
CVE-2026-44944	8.5	0.6	open-iscsi	open-iscsi	CWE-863	iscsiuio control-socket authentication bypass in open-iscsi
CVE-2026-62343	4.7	0.5	ImageMagick	ImageMagick	CWE-190	ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid k…
CVE-2026-6102	7.8	0.4	MSI	MSI Center	CWE-346	MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vul…
CVE-2026-8497	7.4	0.3	Devolutions	Password Manager	CWE-295	Improper certificate validation in the Devolutions Server connection handling…
CVE-2026-67433	5.8	0.2	Linuxfabrik	monitoring-plugins	CWE-59	Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database …

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-07-29 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.